When attempting to detect certain Microsoft formatted documents, Network Prevent may be failing to create an incident.
Any DLP environment using Network Prevent (ICAP).
No error message present in the logs.
Network Prevent ICAP uses content type for inspection, you may need to include the MIME types for your specific needs. For example, incidents may be getting triggered on .doc and not docx, or .xls and not .xlsx. In this case, you will need to add the content type for stream.
Access your Network Prevent server(s) from the Enforce UI, then click on the "ICAP" tab and find the text box for "Response Filtering" > "Inspect Content Type". Add the following MIME types for the file extensions you are wanting to detect on: